AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls

Flags CloudTrail S3 management API actions that modify bucket protections or move/restore objects.

FreeReviewedSigma · Low · v5

Product: aws
Service: cloudtrail
Author: Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published: 2021-07-24
Updated: 2026-07-31

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1537Transfer Data to Cloud Account
Impact

What it detects

This rule flags AWS CloudTrail events where an identity performs S3 data management actions that modify bucket configuration or object replication state. Attackers may use these S3 controls to weaken security settings, alter data handling, or change replication behavior to support unauthorized access or persistence. The detection relies on CloudTrail telemetry with eventSource set to s3.amazonaws.com and eventName matching the listed S3 management and replication operations.

Reporting behind it

Related detections9 linkedT1537 — drag to rearrange

Suspicious S3 Bucket Replication Configured via Scattered Spider Exfiltration Technique

Suspicious AWS Instance Access or Export via SSH Key or Export Task

Suspicious Container Image Export via ctr in Cloud Model Exfiltration

Suspicious AWS Transfer Family Server Creation for Data Exfiltration (via cloudtrail)

Suspicious EC2 Snapshot Attribute Modification for External Sharing via CloudTrail

Suspicious Cross-Project Compute Snapshot Creation via GCP Audit

Suspicious Compute Disk IAM Policy Modification Granting Owner Role via GCP Audit

Suspicious EBS Snapshot Shared With External Account via CloudTrail

Suspicious GCP Bucket Deletion for Namespace Hijacking (via gcp)

AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls

Pivot detection · T1537 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-s3-bucket-configuration-and-object-restore-tampering-via-manageme-78b3756a

title: AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls
id: c8d90b9a-dced-437b-a995-7e77e03abf1a
status: test
description: This rule flags AWS CloudTrail events where an identity performs S3 data management actions that modify bucket configuration or object replication state. Attackers may use these S3 controls to weaken security settings, alter data handling, or change replication behavior to support unauthorized access or persistence. The detection relies on CloudTrail telemetry with eventSource set to s3.amazonaws.com and eventName matching the listed S3 management and replication operations.
references:
  - https://github.com/elastic/detection-rules/pull/1145/files
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html
  - https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-07-24
modified: 2022-10-09
tags:
  - attack.exfiltration
  - attack.t1537
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: s3.amazonaws.com
    eventName:
      - PutBucketLogging
      - PutBucketWebsite
      - PutEncryptionConfiguration
      - PutLifecycleConfiguration
      - PutReplicationConfiguration
      - ReplicateObject
      - RestoreObject
  condition: selection
falsepositives:
  - A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: 78b3756a-7804-4ef7-8555-7b9024a02e2d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL